CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
4215 vulnerabilities reference this CWE, most recent first.
GHSA-HMQV-JRJ9-68XX
Vulnerability from github – Published: 2026-09-08 18:33 – Updated: 2026-09-08 18:33Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
{
"affected": [],
"aliases": [
"CVE-2026-78462"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-08T18:20:44Z",
"severity": "HIGH"
},
"details": "Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.",
"id": "GHSA-hmqv-jrj9-68xx",
"modified": "2026-09-08T18:33:25Z",
"published": "2026-09-08T18:33:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78462"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78462"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HMV7-P2F3-V8FP
Vulnerability from github – Published: 2024-05-20 15:31 – Updated: 2025-01-31 12:33An Improper Access Control vulnerability exists in lunary-ai/lunary version 1.2.2, where users can view and update any prompts in any projects due to insufficient access control checks in the handling of PATCH and GET requests for template versions. This vulnerability allows unauthorized users to manipulate or access sensitive project data, potentially leading to data integrity and confidentiality issues.
{
"affected": [],
"aliases": [
"CVE-2024-4151"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-20T15:15:08Z",
"severity": "HIGH"
},
"details": "An Improper Access Control vulnerability exists in lunary-ai/lunary version 1.2.2, where users can view and update any prompts in any projects due to insufficient access control checks in the handling of PATCH and GET requests for template versions. This vulnerability allows unauthorized users to manipulate or access sensitive project data, potentially leading to data integrity and confidentiality issues.",
"id": "GHSA-hmv7-p2f3-v8fp",
"modified": "2025-01-31T12:33:01Z",
"published": "2024-05-20T15:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4151"
},
{
"type": "WEB",
"url": "https://github.com/lunary-ai/lunary/commit/ddfd497afd017a6946c582a1a806687fdac888bf"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/4acfef85-dedf-43bd-8438-0d8aaa4ffa01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-HP26-Q66V-Q2W7
Vulnerability from github – Published: 2026-05-14 14:57 – Updated: 2026-06-09 13:10Summary
A Mass Assignment vulnerability exists in the assistant update endpoint of FlowiseAI.
The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating an assistant resource.
Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign assistants to arbitrary workspaces. This breaks tenant isolation in multi-workspace environments.
Details
The endpoint responsible for updating assistants:
PUT /api/v1/assistants/{assistantId}
accepts a JSON request body containing assistant metadata.
However, the server does not restrict which properties may be modified by the client. As a result, user-controlled request bodies can include additional fields that should normally be controlled only by the backend.
Server-controlled fields that can be manipulated include:
- workspaceId
- createdDate
- updatedDate
These fields appear to be directly mapped to the underlying database entity without strict DTO whitelisting or authorization checks.
For example, the following request body was accepted:
{
"details": "",
"credential": "11ca7fef-c9b1-4c87-aa54-e547aed8a249",
"iconSrc": null,
"type": "CUSTOM",
"createdDate": "2026-03-06T17:31:04.000Z",
"updatedDate": "2026-03-06T17:31:55.000Z",
"workspaceId": "11111111-2222-3333-4444-555555555555"
}
This indicates that internal, server-controlled properties can be modified by an authenticated user.
PoC
- Authenticate to the Flowise interface.
- Capture the request used to update an assistant:
PUT /api/v1/assistants/<ASSISTANT_ID>
Content-Type: application/json
Modify the request body by injecting server-controlled fields:
{
"details": "",
"credential": "11ca7fef-c9b1-4c87-aa54-e547aed8a249",
"iconSrc": null,
"type": "CUSTOM",
"createdDate": "2026-03-06T17:31:04.000Z",
"updatedDate": "2026-03-06T17:31:55.000Z",
"workspaceId": "11111111-2222-3333-4444-555555555555"
}
3.Send the request.
Observe that the response accepts and persists the attacker-controlled workspaceId and metadata fields.
Impact
This vulnerability allows authenticated users to manipulate internal attributes of assistant resources.
Confirmed impacts include:
- Cross-workspace reassignment of assistants (workspaceId)
- Unauthorized modification of metadata (createdDate, updatedDate)
In multi-tenant deployments, this may allow an attacker to move assistants between workspaces without authorization, breaking tenant isolation boundaries.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.1.1"
},
"package": {
"ecosystem": "npm",
"name": "flowise"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-46441"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-639",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-14T14:57:46Z",
"nvd_published_at": "2026-06-08T16:16:41Z",
"severity": "HIGH"
},
"details": "### Summary\nA Mass Assignment vulnerability exists in the assistant update endpoint of FlowiseAI.\n\nThe endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating an assistant resource.\n\nDue to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign assistants to arbitrary workspaces. This breaks tenant isolation in multi-workspace environments.\n\n### Details\nThe endpoint responsible for updating assistants:\n\n**PUT /api/v1/assistants/{assistantId}**\n\naccepts a JSON request body containing assistant metadata.\n\nHowever, the server does not restrict which properties may be modified by the client. As a result, user-controlled request bodies can include additional fields that should normally be controlled only by the backend.\n\nServer-controlled fields that can be manipulated include:\n\n1. workspaceId\n2. createdDate\n3. updatedDate\n\nThese fields appear to be directly mapped to the underlying database entity without strict DTO whitelisting or authorization checks.\n\nFor example, the following request body was accepted:\n\n```json\n{\n \"details\": \"\",\n \"credential\": \"11ca7fef-c9b1-4c87-aa54-e547aed8a249\",\n \"iconSrc\": null,\n \"type\": \"CUSTOM\",\n \"createdDate\": \"2026-03-06T17:31:04.000Z\",\n \"updatedDate\": \"2026-03-06T17:31:55.000Z\",\n \"workspaceId\": \"11111111-2222-3333-4444-555555555555\"\n}\n```\n\nThis indicates that internal, server-controlled properties can be modified by an authenticated user.\n\n### PoC\n\n1. Authenticate to the Flowise interface.\n2. Capture the request used to update an assistant:\n\n```http\nPUT /api/v1/assistants/\u003cASSISTANT_ID\u003e\nContent-Type: application/json\n\nModify the request body by injecting server-controlled fields:\n\n{\n \"details\": \"\",\n \"credential\": \"11ca7fef-c9b1-4c87-aa54-e547aed8a249\",\n \"iconSrc\": null,\n \"type\": \"CUSTOM\",\n \"createdDate\": \"2026-03-06T17:31:04.000Z\",\n \"updatedDate\": \"2026-03-06T17:31:55.000Z\",\n \"workspaceId\": \"11111111-2222-3333-4444-555555555555\"\n}\n\n```\n3.Send the request.\n\nObserve that the response accepts and persists the attacker-controlled workspaceId and metadata fields.\n\n### Impact\nThis vulnerability allows authenticated users to manipulate internal attributes of assistant resources.\n\nConfirmed impacts include:\n\n- Cross-workspace reassignment of assistants (workspaceId)\n- Unauthorized modification of metadata (createdDate, updatedDate)\n\nIn multi-tenant deployments, this may allow an attacker to move assistants between workspaces without authorization, breaking tenant isolation boundaries.",
"id": "GHSA-hp26-q66v-q2w7",
"modified": "2026-06-09T13:10:13Z",
"published": "2026-05-14T14:57:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-hp26-q66v-q2w7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46441"
},
{
"type": "PACKAGE",
"url": "https://github.com/FlowiseAI/Flowise"
},
{
"type": "WEB",
"url": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource Reassignment"
}
GHSA-HP88-WCMX-23JQ
Vulnerability from github – Published: 2022-01-04 00:00 – Updated: 2022-05-12 00:00TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can upload arbitrary files including HTML and CGI formats.
{
"affected": [],
"aliases": [
"CVE-2021-45428"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-03T14:15:00Z",
"severity": "CRITICAL"
},
"details": "TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can upload arbitrary files including HTML and CGI formats.",
"id": "GHSA-hp88-wcmx-23jq",
"modified": "2022-05-12T00:00:25Z",
"published": "2022-01-04T00:00:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45428"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/1wM1SPOfB9mH2SES7cAmlysuI9fOpFB3F/view?usp=sharing"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/167101/TLR-2005KSH-Arbitrary-File-Upload.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HP9P-WJ8M-C339
Vulnerability from github – Published: 2026-07-16 18:31 – Updated: 2026-07-16 18:31A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, leading to the disclosure of sensitive group attributes and configuration.
{
"affected": [],
"aliases": [
"CVE-2026-15945"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-16T18:16:42Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the group search functionality of the Keycloak server\u0027s administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, leading to the disclosure of sensitive group attributes and configuration.",
"id": "GHSA-hp9p-wj8m-c339",
"modified": "2026-07-16T18:31:34Z",
"published": "2026-07-16T18:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15945"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-15945"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501302"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HPGR-7W89-8XM5
Vulnerability from github – Published: 2022-09-07 00:01 – Updated: 2024-03-21 03:34Squiz Matrix CMS 6.20 is vulnerable to an Insecure Direct Object Reference caused by failure to correctly validate authorization when submitting a request to change a user's contact details.
{
"affected": [],
"aliases": [
"CVE-2022-32277"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-06T20:15:00Z",
"severity": "MODERATE"
},
"details": "Squiz Matrix CMS 6.20 is vulnerable to an Insecure Direct Object Reference caused by failure to correctly validate authorization when submitting a request to change a user\u0027s contact details.",
"id": "GHSA-hpgr-7w89-8xm5",
"modified": "2024-03-21T03:34:18Z",
"published": "2022-09-07T00:01:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32277"
},
{
"type": "WEB",
"url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog"
},
{
"type": "WEB",
"url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/squiz-matrix-cms-authenticated-privilege-escalation-through-idor"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HPHP-FMHR-5FQH
Vulnerability from github – Published: 2026-07-06 21:30 – Updated: 2026-07-06 21:30Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.
{
"affected": [],
"aliases": [
"CVE-2026-59712"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-06T21:16:58Z",
"severity": "HIGH"
},
"details": "Leantime\u0027s Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.",
"id": "GHSA-hphp-fmhr-5fqh",
"modified": "2026-07-06T21:30:43Z",
"published": "2026-07-06T21:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59712"
},
{
"type": "WEB",
"url": "https://github.com/Leantime/leantime/issues/3556"
},
{
"type": "WEB",
"url": "https://github.com/Leantime/leantime/commit/4f2612d13e0e8a2093092a846b44506cf133b671"
},
{
"type": "WEB",
"url": "https://github.com/Leantime/leantime"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/leantime-credential-disclosure-via-unauthenticated-json-rpc-users-getuser-method"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-HPR7-FPW7-JCX2
Vulnerability from github – Published: 2023-08-18 15:30 – Updated: 2024-10-07 21:33An issue was discovered in phpList 3.6.12. Due to an access error, it was possible to manipulate and edit data of the system's super admin, allowing one to perform an account takeover of the user with super-admin permission.
{
"affected": [],
"aliases": [
"CVE-2023-27576"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-18T15:15:09Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in phpList 3.6.12. Due to an access error, it was possible to manipulate and edit data of the system\u0027s super admin, allowing one to perform an account takeover of the user with super-admin permission.",
"id": "GHSA-hpr7-fpw7-jcx2",
"modified": "2024-10-07T21:33:27Z",
"published": "2023-08-18T15:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27576"
},
{
"type": "WEB",
"url": "https://github.com/phpList/phplist3/pull/986"
},
{
"type": "WEB",
"url": "https://cupc4k3.lol/cve-2023-27576-hacking-phplist-how-i-gained-super-admin-access-44c7c90d82da"
},
{
"type": "WEB",
"url": "https://www.phplist.org/newslist/phplist-3-6-14-release-notes"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HPXP-RX7C-457J
Vulnerability from github – Published: 2026-04-09 00:32 – Updated: 2026-08-27 21:31Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
{
"affected": [],
"aliases": [
"CVE-2026-4398"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-08T23:16:59Z",
"severity": "MODERATE"
},
"details": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.",
"id": "GHSA-hpxp-rx7c-457j",
"modified": "2026-08-27T21:31:13Z",
"published": "2026-04-09T00:32:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4398"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3549150"
},
{
"type": "WEB",
"url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/600360"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HPXV-VPFV-7JC9
Vulnerability from github – Published: 2022-05-24 16:52 – Updated: 2024-02-12 11:46An insecure direct object reference (IDOR) vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unauthorized disclosure of company credit history details.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.18"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-7854"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-17T21:02:25Z",
"nvd_published_at": "2019-08-02T22:15:00Z",
"severity": "HIGH"
},
"details": "An insecure direct object reference (IDOR) vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unauthorized disclosure of company credit history details.",
"id": "GHSA-hpxv-vpfv-7jc9",
"modified": "2024-02-12T11:46:52Z",
"published": "2022-05-24T16:52:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7854"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7854.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/magento/magento2"
},
{
"type": "WEB",
"url": "https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20220121051916/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Magento 2 Community Edition IDOR Vulnerability"
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.